#!/bin/bash
# kiosk-session — main process of kiosk.service.
#
# Launches the weston compositor in the FOREGROUND (so it owns the logind seat
# session systemd set up via PAMName=login) and, once weston's Wayland socket is
# up, runs Chromium fullscreen in the BACKGROUND with a crash-restart loop.
#
# Why a wrapper instead of weston.ini [autolaunch]: EPEL 9 ships weston 8.0,
# which has neither kiosk-shell.so nor [autolaunch] (both weston 9.0). So weston
# runs desktop-shell.so (see weston.ini) and we start Chromium here.
#
# Process model: systemd -> this script -> exec weston. The Chromium loop is
# forked before the exec, so it lives in the unit's cgroup; when weston exits the
# service is torn down (KillMode=control-group) and the loop dies with it. If
# Chromium alone crashes, the loop relaunches it without taking weston down.
#
# KIOSK_URL comes from /etc/kiosk/kiosk.env. The Chromium profile/cache live on
# tmpfs (root is read-only erofs + volatile overlay) — writes land in RAM; watch
# RAM if the page is heavy (it can starve the NVMe-oF keep-alive — see TODO).
set -uo pipefail

: "${KIOSK_URL:?KIOSK_URL not set in /etc/kiosk/kiosk.env}"
export XDG_RUNTIME_DIR="${XDG_RUNTIME_DIR:-/run/user/$(id -u)}"
SOCK=wayland-kiosk

BROWSER=$(command -v chromium-browser || command -v chromium || true)
: "${BROWSER:?chromium not found (expected chromium-browser or chromium in PATH)}"

# Background: wait (up to ~60s) for weston's socket, then keep Chromium running.
(
    for _ in $(seq 1 120); do
        [ -S "$XDG_RUNTIME_DIR/$SOCK" ] && break
        sleep 0.5
    done
    export WAYLAND_DISPLAY="$SOCK"
    while :; do
        # --disable-* / --no-pings etc.: stop Chromium phoning home to Google
        # (background networking = variations/field-trials + GCM, component &
        # auto updates, domain reliability, crash upload, hyperlink pings). The
        # --disable-features list kills the Optimization Guide hints fetch
        # (optimizationguide-pa.googleapis.com), Translate, Media Router discovery
        # and Autofill server calls. The comprehensive lockdown (sign-in, metrics,
        # safe browsing, search suggest, ...) is the managed policy at
        # /etc/chromium/policies/managed/10-kiosk-lockdown.json; these flags cover
        # what policy can't. A fixed-URL kiosk needs none of it.
        "$BROWSER" \
            --kiosk --noerrdialogs --disable-infobars --incognito --no-first-run \
            --disable-session-crashed-bubble --start-maximized \
            --ozone-platform=wayland --disable-gpu \
            --disable-background-networking --disable-component-update \
            --disable-sync --disable-domain-reliability --disable-breakpad \
            --no-pings --no-default-browser-check --metrics-recording-only \
            --disable-search-engine-collection \
            --disable-features=Translate,OptimizationHints,OptimizationTargetPrediction,MediaRouter,AutofillServerCommunication,InterestFeedContentSuggestions \
            --user-data-dir=/tmp/kiosk-profile --disk-cache-dir=/tmp/kiosk-cache \
            "$KIOSK_URL" || true
        sleep 2
    done
) &

# weston as the foreground process (owns the seat; service restarts if it dies).
# desktop-shell + explicit socket; --use-pixman = software rendering for VMs.
exec weston --use-pixman --socket="$SOCK" --config=/etc/xdg/weston/weston.ini
